Channelizer: Explainable ML Inference for Validating Side-Channel Resistant Systems

Security validation is an essential step in the design of secure systems. One important security goal is achieving freedom from digital side channels. Eliminating control, memory, and micro-architectural side channels is a vital task since these vulnerabilities have been utilized to breach many secure systems, including Intel SGX, AMD SEV, and ARM TrustZone. To address side channels, privacy-enhanced systems deploy defenses that mitigate system behaviors that could inadvertently disclose sensitive data. These defenses include the utilization of data-oblivious algorithms and encrypted computation. To help system designers establish confidence that their privacy-enhanced designs are free of digital side channels, we have developed an open-source tool called Channelizer. Channelizer executes simple binary decision programs that are designed to excite digital side channels. As these programs run on varied inputs, numerous hardware performance monitoring unit (PMU) events are collected and fed to an ML-based inference framework. Using cross-validation, a subset of binary decision program executions is used to train a multi-model ML framework. If the fully trained ML model is incapable of successfully predicting the binary decision outcome of other executions by only looking at system PMU events, we have generated a strong level of confidence that the system is eliminating digital side channels. A key benefit of our ML- based inference framework, compared to past work, is that Channelizer is both agnostic to the design it is analyzing and the side channels it is trying to discover. In our analyses, we show systems that attempt to eliminate side channels and fail, systems that don't even try and fail spectacularly, and systems that are successful at avoiding side-channel inference. We successfully fix compiler and language level problems we encountered, but we were unable to fix a disclosed CPU microarchitectural side channel that was detected. Additionally, we provide an ML explainability framework that helps designers discern what aspect of their design is leaking sensitive information.